CVE-2026-65829 json
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
published last mo. modified last mo. also EUVD-2026-84819 , GHSA-7952-gx68-cjqr , PYSEC-2026-4108
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
Patch / fix
- nuget MPXJ.Net 16.5.0
- rubygems mpxj 16.5.0
- pypi mpxj 16.5.0
- nuget net.sf.mpxj 16.5.0
- nuget net.sf.mpxj-for-csharp 16.5.0
- nuget net.sf.mpxj-for-vb 16.5.0
- maven net.sf.mpxj:mpxj 16.5.0
- mpxj mpxj 16.5.0
Is CVE-2026-65829 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | MPXJ.Net | >=7.3.0, <16.5.0 |
16.5.0 |
| rubygems | mpxj | >=7.3.0, <16.5.0 |
16.5.0 |
| pypi | mpxj | >=7.3.0, <16.5.0 |
16.5.0 |
| nuget | net.sf.mpxj | >=7.3.0, <16.5.0 |
16.5.0 |
| nuget | net.sf.mpxj-for-csharp | >=7.3.0, <16.5.0 |
16.5.0 |
| nuget | net.sf.mpxj-for-vb | >=7.3.0, <16.5.0 |
16.5.0 |
| maven | net.sf.mpxj:mpxj | >=7.3.0, <16.5.0 |
16.5.0 |
Affected products
- joniles mpxj
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f
web
-
github.com
/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr
web
-
github.com
/joniles/mpxj/releases/tag/v16.5.0
web
-
github.com
/joniles/mpxj
package
-
pypi.org
/project/mpxj
package
-
github.com
/advisories/GHSA-7952-gx68-cjqr
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-65829
advisory
Sources
- CVE List CVE-2026-65829
- GitHub Advisory GHSA-7952-gx68-cjqr
- NVD CVE-2026-65829
- OSV PYSEC-2026-4108
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.